Getting Data In

Line Breaking event into multiple events -

splunker12er
Motivator

Sample log:

Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6: PCI bridge to [bus 11-11]
Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6:   bridge window [io  0xf000-0x0000] (disabled)
Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6:   bridge window [mem 0xd3d00000-0xd3dfffff]
Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.6:   bridge window [mem 0xd5300000-0xd53fffff 64bit pref]
Oct 14 04:26:40 localhost kernel: : pci 0000:00:16.7: PCI bridge to [bus 12-12]

props.conf:

[my_custom]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = true

I set the above property to break that single event , but it seems it doesnt work, since the Timestamp is same in all the events does it always consider this as a single event ?

or any other settings to include in my props ? Please help

Source : http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Indexmulti-lineevents

0 Karma

lguinn2
Legend

If all events are a single line, it would be significantly more efficient to do this:

 [my_custom]
 SHOULD_LINEMERGE = false

Also, your settings are the default, so you shouldn't need them anyway. Is it possible that Splunk is not interpreting the timestamp correctly? If Splunk doesn't recognize the timestamp, then your BREAK_ONLY_BEFORE_DATE = true setting will not work.

my_custom should be the name of the sourcetype of the data - it must match exactly, including case.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...